Researchers Demonstrate Coin-Sized Device That Can Hijack Boeing 737 Autopilot

Researchers from the University of California at San Diego and Oberlin College have created a Wi-Fi-enabled, coin-sized device costing less than $100 that can commandeer a Boeing 737’s autopilot by exploiting an externally reachable port typically used for maintenance. In less than a minute the implant can be inserted, then transmit electrical signals that overwrite commands to the flight-management computer and the multipurpose control display, allowing attackers to falsify critical data such as aircraft weight, outside temperature or navigation waypoints while showing false readings to pilots.

The technique, dubbed “Bus Driver,” was validated on a laboratory test bed and later demonstrated inside a Boeing facility, after the team spent over a decade acquiring and assembling spare avionics components. Boeing reviewed the findings and maintains that layered protections reduce the likelihood of a successful real-world attack, though it has not disclosed any immediate hardware fix. The researchers argue that, without redesign, the flaw could remain exploitable for years and recommend sealing or removing the vulnerable connector, or upgrading software defenses with authentication and isolation measures. They stress that the discovery highlights a broader need to rethink physical-access threat models for critical aviation systems.